VulCode

GDPR and data processing agreements: when we process data on your behalf

When we maintain your website, move your store or build a panel with a customer base, we get access to personal data that you are responsible for. This is how we keep it in order.

Trust and documents
Personal data processing agreement
A sample layout under Art. 28(3) GDPR
Controller
You, the owner of the website, store or system
Processor
Michał Fox, VulCode
  1. § 1Subject, duration, nature and purpose
  2. § 2Only on your instructionsa
  3. § 3Confidentialityb
  4. § 4Securityc
  5. § 5Sub-processingd
  6. § 6Help with data subject rightse
  7. § 7Help with security and breachesf
  8. § 8End of the workg
  9. § 9Information and auditsh

You can send your own template. If you do not have one, we will draft an agreement for your approval.

When a processing agreement is needed

Typical situations from our projects. If yours is different, ask and we will assess it together.

An agreement is needed

  • Maintaining a website or store. We have access to the server and the database with orders, accounts or form messages. An agreement is needed.
  • A migration with a customer base. We move customers and orders to a new system. Throughout the migration we process that data on your behalf.
  • A panel or CRM on your data. When we build a system on a real database or import data into it. The agreement is needed from the first import.
  • Taking over a project from another company. We receive the code together with the production database. We sign the agreement before we get access.
Conclusion: We sign it before we get access to the personal data in your project.

An agreement is usually not needed

  • A new site without personal data. A landing page without a form, or a site whose messages go straight to your inbox. An agreement is usually not needed.
  • Working on test data only. We build on made-up data and you load the real data yourself. Then we do not process personal data on your behalf.
Conclusion: We then do not process personal data on your behalf, so the terms and the order are enough.

What a processing agreement must contain

The list from Art. 28(3) GDPR. Every agreement we sign as a processor has these elements.

  1. Subject, duration, nature and purposeWhich data, for what purpose and for how long we process it, and the categories of people concerned.
  2. Only on your instructionsWe process data only on documented instructions from the controller (point a).
  3. ConfidentialityPeople with access to the data are bound to confidentiality (point b).
  4. SecurityWe apply the measures of Art. 32, appropriate to the risk (point c).
  5. Sub-processingWe engage another processor only with your authorisation (point d).
  1. Help with data subject rightsWe help answer requests from the people the data is about (point e).
  2. Help with security and breachesWe support you with the obligations of Articles 32 to 36 (point f).
  3. End of the workWe delete or return the data, as you decide (point g).
  4. Information and auditsWe provide what is needed to demonstrate compliance and allow audits (point h).
You choose: return or deletionUnder Art. 28(3)(g) you decide whether we return the data to you or delete it.
An export in a readable formatYou get the database or part of it in a format another system can import.
We delete the data and copiesWorking copies included, unless the law requires keeping them.
We close our accessRemove our accounts and keys, or ask us and we will do it and confirm.

Controller and processor

You decide why and how your customers' data is processed. We only do with it what you ask us to. We are a small team, so this list is short and specific.

You, the controller

You are responsible for your customers' data and the decisions about it.

  • You decide why and how customer data is processed

    The controller determines the purposes and means of processing (Art. 4(7) GDPR). In your store, panel or website with a form, the controller is you.

  • You report a breach to the authority

    Within 72 hours of becoming aware, where it poses a risk to people (Art. 33(1)).

  • You tell the people when the risk is high

    Where the risk is high, the people concerned are told directly (Art. 34).

  • You answer the requests of the people the data is about

    Access, rectification, erasure, restriction, portability and objection. The request goes to you, and we help carry it out technically.

  • You choose whether the data is returned or deleted

    Under Art. 28(3)(g) you decide whether we return the data to you or delete it.

Us, the processor

We process data on your behalf (Art. 4(8)), under an Art. 28 agreement.

  • Only on your documented instructions

    We process data only on documented instructions from the controller (point a).

  • Michał "DualFroz" Fox

    Developer. Has access to servers and databases when a project task requires it.

  • We tell you about a breach

    Without undue delay, with what it concerns and what we have already done (Art. 33(2)).

    You, the controller: what the breach concerns and what we have already done
  • We remove the cause and describe the changes

    We remove the cause and describe what we changed so it does not happen again.

Sub-processors

Another processor only with your authorisation (point d).

  • Hosting and email

    The server and email providers we have processing agreements with, as our privacy policy describes.

  • The list for your project

    The list of entities processing data in a given project is part of its processing agreement.

  • Cloudflare Turnstile

    Spam protection for the forms on vulcode.com. It concerns our website, not your project.

  • Transfers outside the EEA

    In your project it depends on the services chosen, and each one is named in the agreement.

Rights of the people the data is about

The request goes to you as the controller. As a processor we help carry it out technically.

  1. Art. 15

    Access

    We pull everything about that person from the database.

  2. Art. 16

    Rectification

    We correct the data or add a way to edit it in the panel.

  3. Art. 17

    Erasure

    We delete the records and related data, including places that are easy to forget.

  4. Art. 18

    Restriction

    We flag the data so the system stops using it without deleting it.

  5. Art. 20

    Portability

    An export in a structured format another system can read.

  6. Art. 21

    Objection

    We switch off the processing the objection is about, for example mailings.

The right to erasure in our panel

In the client panel we are the controller of your data, and deleting your account is a button in your settings, not a letter to a legal department.

  • A panel dialog: send a request to delete the account? A confirmation link goes to the email, the account is gone after 3 days

    Request in settings

    In your account settings you choose to delete the account.

  • An email from the panel with the button that confirms the deletion, the link expires in 24 hours

    Email confirmation

    You get a confirmation link, valid for 24 hours. Nothing happens until you click it.

  • Panel settings with the bar: the account will be deleted on 11.10.2026, with the Cancel deletion button

    Three days to change your mind

    Deletion is scheduled 3 days after confirmation and you can cancel it until then. After three days the account is gone. Accounting documents stay for as long as the law requires.

GDPR questions

What clients ask before signing a processing agreement.

Need a processing agreement?

Tell us what the project is and what data we will process. We will reply with a draft agreement or comments on your template.